HTTP response schema collection and data classification #8938
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sezen-datadog
force-pushed
the
sezen.leblay/APPSEC-57259-extract-schema-spring
branch
from
f3bdd40 to
7c044fd
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 1 performance improvements and 2 performance regressions! Performance is the same for 55 metrics, 13 unstable metrics.
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.50.0-SNAPSHOT~6d9e334825, baseline=1.50.0-SNAPSHOT~05d97db941
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.027 s) : 0, 1026515
Total [baseline] (8.534 s) : 0, 8534276
Agent [candidate] (1.028 s) : 0, 1027500
Total [candidate] (8.567 s) : 0, 8566663
section iast
Agent [baseline] (1.15 s) : 0, 1149568
Total [baseline] (9.186 s) : 0, 9186255
Agent [candidate] (1.157 s) : 0, 1156593
Total [candidate] (9.25 s) : 0, 9250358
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.154 s) : 0, 1154176
Total [baseline] (9.14 s) : 0, 9140076
Agent [candidate] (1.158 s) : 0, 1158346
Total [candidate] (9.251 s) : 0, 9251306
section iast_TELEMETRY_OFF
Agent [baseline] (1.147 s) : 0, 1146591
Total [baseline] (9.255 s) : 0, 9254870
Agent [candidate] (1.155 s) : 0, 1154702
Total [candidate] (9.275 s) : 0, 9274686
gantt
title insecure-bank - break down per module: candidate=1.50.0-SNAPSHOT~6d9e334825, baseline=1.50.0-SNAPSHOT~05d97db941
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (684.131 ms) : 0, 684131
BytebuddyAgent [candidate] (682.438 ms) : 0, 682438
GlobalTracer [baseline] (240.875 ms) : 0, 240875
GlobalTracer [candidate] (240.373 ms) : 0, 240373
AppSec [baseline] (56.461 ms) : 0, 56461
AppSec [candidate] (60.404 ms) : 0, 60404
Debugger [baseline] (6.225 ms) : 0, 6225
Debugger [candidate] (6.236 ms) : 0, 6236
Remote Config [baseline] (742.555 µs) : 0, 743
Remote Config [candidate] (685.601 µs) : 0, 686
Telemetry [baseline] (14.512 ms) : 0, 14512
Telemetry [candidate] (13.816 ms) : 0, 13816
section iast
BytebuddyAgent [baseline] (801.522 ms) : 0, 801522
BytebuddyAgent [candidate] (802.522 ms) : 0, 802522
GlobalTracer [baseline] (230.657 ms) : 0, 230657
GlobalTracer [candidate] (230.658 ms) : 0, 230658
IAST [baseline] (26.777 ms) : 0, 26777
IAST [candidate] (25.65 ms) : 0, 25650
AppSec [baseline] (52.701 ms) : 0, 52701
AppSec [candidate] (59.763 ms) : 0, 59763
Debugger [baseline] (5.934 ms) : 0, 5934
Debugger [candidate] (5.97 ms) : 0, 5970
Remote Config [baseline] (600.649 µs) : 0, 601
Remote Config [candidate] (606.508 µs) : 0, 607
Telemetry [baseline] (7.929 ms) : 0, 7929
Telemetry [candidate] (7.875 ms) : 0, 7875
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (805.955 ms) : 0, 805955
BytebuddyAgent [candidate] (802.134 ms) : 0, 802134
GlobalTracer [baseline] (230.375 ms) : 0, 230375
GlobalTracer [candidate] (231.893 ms) : 0, 231893
IAST [baseline] (26.291 ms) : 0, 26291
IAST [candidate] (25.678 ms) : 0, 25678
AppSec [baseline] (53.461 ms) : 0, 53461
AppSec [candidate] (60.414 ms) : 0, 60414
Debugger [baseline] (5.917 ms) : 0, 5917
Debugger [candidate] (6.072 ms) : 0, 6072
Remote Config [baseline] (591.483 µs) : 0, 591
Remote Config [candidate] (605.453 µs) : 0, 605
Telemetry [baseline] (7.896 ms) : 0, 7896
Telemetry [candidate] (8.021 ms) : 0, 8021
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (798.48 ms) : 0, 798480
BytebuddyAgent [candidate] (800.61 ms) : 0, 800610
GlobalTracer [baseline] (230.884 ms) : 0, 230884
GlobalTracer [candidate] (231.818 ms) : 0, 231818
IAST [baseline] (25.688 ms) : 0, 25688
IAST [candidate] (30.507 ms) : 0, 30507
AppSec [baseline] (53.687 ms) : 0, 53687
AppSec [candidate] (53.821 ms) : 0, 53821
Debugger [baseline] (5.956 ms) : 0, 5956
Debugger [candidate] (5.987 ms) : 0, 5987
Remote Config [baseline] (592.241 µs) : 0, 592
Remote Config [candidate] (605.282 µs) : 0, 605
Telemetry [baseline] (7.785 ms) : 0, 7785
Telemetry [candidate] (7.936 ms) : 0, 7936
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.50.0-SNAPSHOT~6d9e334825, baseline=1.50.0-SNAPSHOT~05d97db941
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.03 s) : 0, 1029668
Total [baseline] (10.572 s) : 0, 10571713
Agent [candidate] (1.031 s) : 0, 1031478
Total [candidate] (10.582 s) : 0, 10582361
section appsec
Agent [baseline] (1.162 s) : 0, 1162325
Total [baseline] (10.664 s) : 0, 10663889
Agent [candidate] (1.167 s) : 0, 1166632
Total [candidate] (10.689 s) : 0, 10688599
section iast
Agent [baseline] (1.167 s) : 0, 1166540
Total [baseline] (10.857 s) : 0, 10856901
Agent [candidate] (1.173 s) : 0, 1172902
Total [candidate] (10.956 s) : 0, 10955648
section profiling
Agent [baseline] (1.268 s) : 0, 1267876
Total [baseline] (10.933 s) : 0, 10933348
Agent [candidate] (1.281 s) : 0, 1281462
Total [candidate] (10.991 s) : 0, 10990724
gantt
title petclinic - break down per module: candidate=1.50.0-SNAPSHOT~6d9e334825, baseline=1.50.0-SNAPSHOT~05d97db941
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (687.256 ms) : 0, 687256
BytebuddyAgent [candidate] (686.095 ms) : 0, 686095
GlobalTracer [baseline] (241.998 ms) : 0, 241998
GlobalTracer [candidate] (240.147 ms) : 0, 240147
AppSec [baseline] (57.456 ms) : 0, 57456
AppSec [candidate] (62.613 ms) : 0, 62613
Debugger [baseline] (6.211 ms) : 0, 6211
Debugger [candidate] (6.194 ms) : 0, 6194
Remote Config [baseline] (741.972 µs) : 0, 742
Remote Config [candidate] (689.428 µs) : 0, 689
Telemetry [baseline] (12.233 ms) : 0, 12233
Telemetry [candidate] (12.067 ms) : 0, 12067
section appsec
BytebuddyAgent [baseline] (700.147 ms) : 0, 700147
BytebuddyAgent [candidate] (702.071 ms) : 0, 702071
GlobalTracer [baseline] (237.376 ms) : 0, 237376
GlobalTracer [candidate] (238.438 ms) : 0, 238438
IAST [baseline] (21.919 ms) : 0, 21919
IAST [candidate] (22.015 ms) : 0, 22015
AppSec [baseline] (176.285 ms) : 0, 176285
AppSec [candidate] (177.112 ms) : 0, 177112
Debugger [baseline] (5.947 ms) : 0, 5947
Debugger [candidate] (5.999 ms) : 0, 5999
Remote Config [baseline] (639.186 µs) : 0, 639
Remote Config [candidate] (625.827 µs) : 0, 626
Telemetry [baseline] (7.357 ms) : 0, 7357
Telemetry [candidate] (7.743 ms) : 0, 7743
section iast
BytebuddyAgent [baseline] (814.496 ms) : 0, 814496
BytebuddyAgent [candidate] (815.483 ms) : 0, 815483
GlobalTracer [baseline] (233.573 ms) : 0, 233573
GlobalTracer [candidate] (233.757 ms) : 0, 233757
IAST [baseline] (27.822 ms) : 0, 27822
IAST [candidate] (28.855 ms) : 0, 28855
AppSec [baseline] (52.09 ms) : 0, 52090
AppSec [candidate] (56.475 ms) : 0, 56475
Debugger [baseline] (6.048 ms) : 0, 6048
Debugger [candidate] (5.96 ms) : 0, 5960
Remote Config [baseline] (601.948 µs) : 0, 602
Remote Config [candidate] (604.519 µs) : 0, 605
Telemetry [baseline] (8.087 ms) : 0, 8087
Telemetry [candidate] (7.967 ms) : 0, 7967
section profiling
BytebuddyAgent [baseline] (675.882 ms) : 0, 675882
BytebuddyAgent [candidate] (681.9 ms) : 0, 681900
GlobalTracer [baseline] (360.183 ms) : 0, 360183
GlobalTracer [candidate] (362.69 ms) : 0, 362690
AppSec [baseline] (61.908 ms) : 0, 61908
AppSec [candidate] (67.252 ms) : 0, 67252
Debugger [baseline] (6.162 ms) : 0, 6162
Debugger [candidate] (6.101 ms) : 0, 6101
Remote Config [baseline] (670.756 µs) : 0, 671
Remote Config [candidate] (638.429 µs) : 0, 638
Telemetry [baseline] (8.269 ms) : 0, 8269
Telemetry [candidate] (8.052 ms) : 0, 8052
ProfilingAgent [baseline] (103.913 ms) : 0, 103913
ProfilingAgent [candidate] (103.556 ms) : 0, 103556
Profiling [baseline] (103.937 ms) : 0, 103937
Profiling [candidate] (103.582 ms) : 0, 103582
LoadParameters
See matching parameters
SummaryFound 4 performance improvements and 5 performance regressions! Performance is the same for 5 metrics, 16 unstable metrics.
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~6d9e334825, baseline=1.50.0-SNAPSHOT~05d97db941
dateFormat X
axisFormat %s
section baseline
no_agent (15.325 s) : 15325000, 15325000
. : milestone, 15325000,
appsec (14.954 s) : 14954000, 14954000
. : milestone, 14954000,
iast (18.219 s) : 18219000, 18219000
. : milestone, 18219000,
iast_GLOBAL (18.029 s) : 18029000, 18029000
. : milestone, 18029000,
profiling (15.889 s) : 15889000, 15889000
. : milestone, 15889000,
tracing (14.885 s) : 14885000, 14885000
. : milestone, 14885000,
section candidate
no_agent (15.356 s) : 15356000, 15356000
. : milestone, 15356000,
appsec (14.829 s) : 14829000, 14829000
. : milestone, 14829000,
iast (18.631 s) : 18631000, 18631000
. : milestone, 18631000,
iast_GLOBAL (17.982 s) : 17982000, 17982000
. : milestone, 17982000,
profiling (15.329 s) : 15329000, 15329000
. : milestone, 15329000,
tracing (15.003 s) : 15003000, 15003000
. : milestone, 15003000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~6d9e334825, baseline=1.50.0-SNAPSHOT~05d97db941
dateFormat X
axisFormat %s
section baseline
no_agent (1.477 ms) : 1465, 1488
. : milestone, 1477,
appsec (2.399 ms) : 2350, 2448
. : milestone, 2399,
iast (2.191 ms) : 2129, 2252
. : milestone, 2191,
iast_GLOBAL (2.221 ms) : 2160, 2283
. : milestone, 2221,
profiling (2.034 ms) : 1984, 2084
. : milestone, 2034,
tracing (1.992 ms) : 1945, 2040
. : milestone, 1992,
section candidate
no_agent (1.471 ms) : 1459, 1482
. : milestone, 1471,
appsec (2.399 ms) : 2350, 2448
. : milestone, 2399,
iast (2.177 ms) : 2116, 2239
. : milestone, 2177,
iast_GLOBAL (2.23 ms) : 2168, 2292
. : milestone, 2230,
profiling (2.04 ms) : 1990, 2090
. : milestone, 2040,
tracing (2.0 ms) : 1952, 2047
. : milestone, 2000,
|
jandro996
reviewed
Jun 9, 2025
| @@ -627,6 +671,38 @@ private Flow<Void> onRequestBodyDone(RequestContext ctx_, StoredBodySupplier sup | |||
| } | |||
| } | |||
|
|
|||
| private Flow<Void> onResponseBodyDone(RequestContext ctx_, StoredBodySupplier supplier) { | |||
There was a problem hiding this comment.
I need to check the RFC properly but AFAIK response body raw doesn't applies to schema collection
jandro996
reviewed
Jun 10, 2025
Comment on lines
+149
to
+160
| if (action instanceof Flow.Action.RequestBlockingAction) { | ||
| Flow.Action.RequestBlockingAction rba = (Flow.Action.RequestBlockingAction) action; | ||
| BlockResponseFunction brf = reqCtx.getBlockResponseFunction(); | ||
| if (brf != null) { | ||
| brf.tryCommitBlockingResponse( | ||
| reqCtx.getTraceSegment(), | ||
| rba.getStatusCode(), | ||
| rba.getBlockingContentType(), | ||
| rba.getExtraHeaders()); | ||
| } | ||
| throw new BlockingException("Blocked response (for HttpMessageConverter/write)"); | ||
| } |
There was a problem hiding this comment.
Do we need to do this here? we do this in the request to block if it's necessary.
jandro996
reviewed
Jun 10, 2025
| @Advice.OnMethodEnter(suppress = Throwable.class) | ||
| public static void before( | ||
| @Advice.Argument(0) final Object obj, @ActiveRequestContext RequestContext reqCtx) { | ||
| if (obj == null) { |
There was a problem hiding this comment.
As we don't want to collect the response if the request is blocked, maybe it's a good point to check something like AppSecRequestContext#isWafBlocked (only works for waf but we can add another flag for RASP)
jandro996
reviewed
Jun 10, 2025
| if (subInfo == null || subInfo.isEmpty()) { | ||
| return NoopFlow.INSTANCE; | ||
| } | ||
| Object converted = ObjectIntrospection.convert(obj, ctx, () -> {}); |
There was a problem hiding this comment.
We need to change the ObjectInstrospection#conver to be able to use it for response schema collection
Limits
Currently most libraries enforce a set of limits before serialising addresses into ddwaf_object. The default global object limits are the following:
Maximum string length: 4096 bytes
Maximum container depth: 20 levels
Maximum container size: 256 nodes
The schema extraction algorithm has a different set of limits, which are lower than the limits mentioned above:
Maximum container depth: 18 levels
Maximum array size: 10 nodes
Maximum record size: 255 nodes
When serialising addresses to ddwaf_object which aren’t used for anything other than schema extraction, the library may use the schema extraction limits, rather than the global object limits.
https://docs.google.com/document/d/1965kNw_1CScNM15GgLZ0jvMhFH2kLpDYGztw8YeOfjM/edit?tab=t.0
jandro996
reviewed
Jun 10, 2025
There was a problem hiding this comment.
I think that we only need the RESPONSE_BODY_CONVERTED
jandro996
reviewed
Jun 10, 2025
There was a problem hiding this comment.
Same here, I think that we are ok just with RESPONSE_BODY_CONVERTED_ID
jandro996
reviewed
Jun 10, 2025
| @@ -98,6 +98,7 @@ public class AppSecRequestContext implements DataBundle, Closeable { | |||
| private String inferredClientIp; | |||
|
|
|||
| private volatile StoredBodySupplier storedRequestBodySupplier; | |||
| private volatile StoredBodySupplier storedResponseBodySupplier; | |||
There was a problem hiding this comment.
I think we don't need this, as we can pass the response object via callback directly
jandro996
reviewed
Jun 10, 2025
| @@ -106,6 +107,8 @@ public class AppSecRequestContext implements DataBundle, Closeable { | |||
| private boolean rawReqBodyPublished; | |||
| private boolean convertedReqBodyPublished; | |||
| private boolean respDataPublished; | |||
| private boolean rawRespBodyPublished; | |||
sezen-datadog
force-pushed
the
sezen.leblay/APPSEC-57259-extract-schema-spring
branch
2 times, most recently
from
ade8110 to
5aa9177
Compare
sezen-datadog
changed the base branch from
master
to
malvarez/vertx-response-extraction
sezen-datadog
force-pushed
the
sezen.leblay/APPSEC-57259-extract-schema-spring
branch
from
5aa9177 to
5000116
Compare
Signed-off-by: sezen.leblay <sezen.leblay@datadoghq.com>
sezen-datadog
force-pushed
the
sezen.leblay/APPSEC-57259-extract-schema-spring
branch
from
b2f2eb6 to
81198be
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Motivation
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-57259